Granted Patent B2

US 7,461,401 · App. 10/429,977 · Granted Dec 2, 2008

Abstract

Claims (59)

1. A method of handling in a firewall data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said method comprising

allowing a parent connection,

storing information about the parent connection,

monitoring contents of the parent connection,

detecting within the parent connection negotiation of at least one attribute of a related connection, and after said detecting

i) comparing said at least one negotiated attribute of the related connection and at least one piece of said information about the parent connection to a set of rules for finding a matching rule, and deciding on the basis of said matching rule, whether the related connection is allowable,

ii) allowing the related connection to pass through a firewall if the related connection is allowable, and

iii) preventing the related connection from passing through the firewall if the related connection is not allowable, and

wherein said information about the parent connection comprises at least one of the following: a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

2. The method of claim 1 , wherein said at least one attribute of a related connection is a source address, a destination address, a source port, a destination port, used protocol, a user identifier, authentication information, a stream type identifier, or a program identifier.

3. A method of handling in a firewall data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said method comprising

allowing a parent connection,

storing information about the parent connection in a first entry,

monitoring contents of the parent connection,

detecting within the parent connection negotiation of at least one attribute of a related connection,

storing a second entry comprising at least one negotiated attribute of the related connection and at least one piece of information about the parent connection of the first stored entry,

comparing said second entry to a set of rules for finding a matching rule,

deciding on the basis of said matching rule, whether the related connection is allowable,

allowing the related connection to pass through a firewall if the related connection is allowable, and

preventing the related connection from passing through the firewall if the related connection is not allowable,

wherein said information about the parent connection comprises at least one of the following: a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and

wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

4. The method of claim 3 , wherein said at least one piece of information about the parent connection in the second entry is a reference to the first entry, and wherein the step of comparing comprises comparing a combination of said second entry and first entry to the set of rules for finding said matching rule.

5. A computer program product comprising a computer readable medium which contains computer program code which, when executed in a computer device, provides a routine of handling data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said routine comprising

allowing a parent connection,

storing information about the parent connection,

monitoring contents of the parent connection,

detecting within the parent connection negotiation of at least one attribute of a related connection, and after said detecting

i) comparing said at least one negotiated attribute of the related connection and at least one piece of said information about the parent connection to a set of rules for finding a matching rule, and deciding on the basis of said matching rule, whether the related connection is allowable,

ii) allowing the related connection to pass through a firewall if the related connection is allowable, and

iii) preventing the related connection from passing through the firewall if the related connection is not allowable, and

wherein said information about the parent connection comprises at least one of the following: a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

6. The computer program product of claim 5 , wherein said at least one attribute of a related connection is a source address, a destination address, a source port, a destination port, used protocol, a user identifier, authentication information, a stream type identifier, or a program identifier.

7. A computer program product comprising a computer readable medium which contains computer program code which, when executed in a computer device, provides a routine of handling data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said routine comprising

allowing a parent connection,

storing information about the parent connection in a first entry,

monitoring contents of the parent connection,

detecting within the parent connection negotiation of at least one attribute of a related connection,

storing a second entry comprising said at least one negotiated attribute of the related connection

comparing said second entry to a set of rules for finding a matching rule to determine whether the related connection is allowable

allowing the related connection to pass through a firewall, if the related connection is allowable, and

preventing the related connection from passing through the firewall, if the related connection is not allowable,

wherein said information about the parent connection comprises at least one of the following: a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type-identifier, a program identifier, and information identifying a separate processing module used for handling parent connection, and

wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

8. The computer program product of claim 7 , wherein said at least one piece of information about the parent connection in the second entry is a reference to said first entry, and

in that the comparing comprises comparing a combination of said second entry and first entry to the set of rules for finding said matching rule.

9. A firewall device for handling data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one of the addressing details of the at least one related connection is negotiated within the at least one parent connection, said firewall device comprising

a computing unit,

a computer readable medium containing computer program code executed in the computing unit,

a mechanism for allowing a parent connection,

a memory for storing a set of rules,

a memory for storing information about the parent connection,

a mechanism for monitoring contents of the parent connection,

a mechanism for detecting within the parent connection negotiation of at least one attribute of a related connection,

a mechanism, responsive to said detecting mechanism, for comparing said at least one negotiated attribute of the related connection and at least one piece of said information about the parent connection to said set of rules for finding a matching rule, and a mechanism for deciding on the basis of said matching rule, whether the related connection is allowable,

a mechanism, responsive to said deciding, for allowing the related connection to pass through a firewall if the related connection is allowable, and

a mechanism, responsive to said deciding, for preventing the related connection from passing through the firewall if the related connection is not allowable, and

wherein said information about the parent connection comprises at least one of the following: a source address, a destination address, a source port, a destination port, used protocol, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

10. The firewall device of claim 9 , wherein said at least one attribute of a related connection is a source address, a destination address, a source port, a destination port, used protocol, a user identifier, authentication information, a stream type identifier, or a program identifier.

Assignments (10)